fix(yq): reject lossy numbers and harden coverage

[chaliy]

What changed

Hardened the jq-backed yq builtin with substantially broader compatibility and security coverage. Portable specs now cover assignments, file/stdin ordering, JSON streams, formatting, combined/attached flags, exit status, null input, Unicode, and automatic JSON input detection. Integration and property tests cover multi-file aggregate limits, YAML aliases and duplicate keys, parser depth/document bounds, shared jq work budgets, bounded deterministic diagnostics, and arbitrary YAML/filter inputs.

Replaced the stale legacy yaml fuzzer—which only exercised a removed command surface—with a feature-enabled yq fuzzer that probes the real builtin and varies formats, filters, stdin/in-place paths, and execution limits. Added atomic in-place failpoints for allocation, mode preservation, rename, and VFS write failures. A locked 10-case mikefarah/yq v4.53.3 corpus provides portable parity coverage and can run against a live oracle when available.

Non-finite YAML numbers now fail deterministically instead of being silently converted to JSON null.

Why

The initial yq implementation had useful behavior tests, but its fuzz target did not invoke yq, atomic replacement failure stages were not injectable, and important parser/resource/compatibility boundaries were not locked down. Edge-case auditing also found silent data loss for .nan and infinities.

Before / After

Before:

$ printf 'value: .nan\n' | bashkit -c "yq '.'"
value: null

After:

$ printf 'value: .nan\n' | bashkit -c "yq '.'"
yq: non-finite YAML number cannot be represented as JSON

End-to-end smoke proof:

$ printf 'kind: fruit\nname: apple\n---\nkind: fruit\nname: pear\n' | yq -s -o=json -I=0 '[.[] | select(.kind == "fruit") | .name]'
["apple","pear"]

Validation: just pre-pr; 17 failpoint tests; locked fuzz-target build; 100-run fuzz smoke; locked and live mikefarah/yq v4.53.3 differential corpus.

Risk

• Low
• Runtime behavior changes only for YAML non-finite numbers, which now fail closed instead of losing information. Test/fuzz infrastructure enables the existing jq-backed implementation and exercises bounded execution and atomic replacement paths.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	7feabe7	Commit Preview URL Branch Preview URL	Aug 06 2026, 03:22 AM